Adversaries Embrace GenAI: How SOC Teams Can Combat Threats with Technology

Key Takeaways

Generative AI (GenAI) is enhancing the productivity of cyber adversaries, enabling faster execution of attacks.
Security Operations Centre (SOC) teams can leverage GenAI to optimize threat detection and response efforts.
Nearly half of security professionals view GenAI positively, signaling a shift towards improved cybersecurity strategies.

AI’s Impact on Cybersecurity

In early 2023, the UK’s National Cyber Security Centre (NCSC) raised concerns regarding the use of artificial intelligence (AI) in cyber-attacks. However, the emergence of generative AI (GenAI) presents opportunities for both cybercriminals and cybersecurity teams. Striking a balance between leveraging human talent and machine efficiency is the key for Security Operations Centre (SOC) teams to enhance productivity and fortify organizational safety.

While NCSC researchers did not predict new attack methods, they emphasized that AI enables adversaries to optimize existing threats. For instance, threat actors can use GenAI chatbots to create sophisticated social engineering content in multiple languages or to research high-value targets. Current challenges hinder advanced integration of large language models (LLMs) into malicious frameworks, but changes like the Model Context Protocol (MCP) are facilitating these developments. This protocol acts like a “USB for AI,” linking models with tools and data, promising a rise in LLM applications for malicious purposes within the next year.

Adversaries have also increasingly been jailbreaking tools like ChatGPT for illegal use, a phenomenon termed “promptware.” Research indicates that in the first ten months of 2024, OpenAI disrupted numerous operations trying to exploit its technology. Furthermore, specialized self-hosted AI models from open-source LLMs are emerging on the dark web, allowing adversaries to bypass commercial platforms entirely.

In light of these threats, SOC teams face overwhelming challenges. Studies reveal that 87 percent of organizations experienced significant undetected security incidents over the past year. The burden of excessive alerts leads to high stress and burnout among security personnel, with 60 percent reporting that alert noise contributes to staff turnover.

To combat this, SOC teams must harness GenAI productively. By implementing LLM-powered agents, they can automate manual tasks, enhancing productivity. For instance, when addressing a suspicious login, a GenAI agent can quickly collate relevant details—such as previous IP addresses and access patterns—greatly reducing investigation time from 40 minutes to under five.

GenAI also plays a supportive role in SOC operations, offering suggestions based on historical data to guide analysts in their next steps, such as threat hunting or system improvement. While autonomous AI tools promise significant advances, their reliability is yet to be thoroughly tested, reinforcing the need for continuous human oversight. The effectiveness of GenAI outputs is also contingent on the quality of the training data used for the underlying models.

By strategically utilizing GenAI, organizations can enhance the analytical capabilities of their SOC teams, reducing alert fatigue and improving responses to cyber threats. This optimism is reflected in research, showing that 46 percent of security professionals regard GenAI as a beneficial influence, compared to only 6 percent who view it negatively.

Given the rapidly evolving cyber landscape, organizations must be prepared to integrate AI tools effectively, maximizing their security operations while remaining vigilant against new threats. By doing so, they can significantly mitigate risks and leverage the advancements in artificial intelligence for improved cyber resilience.

The content above is a summary. For more details, see the source article.